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Abstract 

A symmetric device-independent quantum key distribution (DIQKD) protocol is proposed in 
this paper, with Holevo hmit and subadditivity of von Neumann entropy, one can bound Eve's 
abihty with collective attack. Together with symmetry of this protocol, the state Eve prepared for 
Alice and Bob, and at the same time, her eavesdropping on Alice's and Bob's measurements can 
Q_| be definitely inferred at the assumption that Eve aims at maximizing her information gain. The 

optimal state under this circumstance can be solely bounded with Alice and Bob's statistical results 
on the quantity of Clauser-Horne-Shimony-Holt (CHSH) polynomial 5, that is, our symmetric 
DIQKD has the same secure basis as that of EkertOl protocol. 
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I. INTRODUCTION 



Quantum key distribution (QKD) is an art of generating physically secure key between 
remote partners, the information sender Alice, and the receiver Bob l|-l3j, even if in the 
presence of a powerful eavesdropper, namely Eve, whose capability is only limited by quan- 
tum mechanics. On one hand, the security proof of QKD has been obtained with nearly 
perfect apparatus j^, 5|. On the other hand, there are different loopholes in current QKD 
experiments that may iniure the security of the final key bits 6l4l2l|. Even with the perfect 
experimental apparatus 0, S], there are also some self-evident assumptions that guarantee 
the security of final key bits. For instance, we have to assume that Alice and Bob have the 
freedom to choose the bases for their preparations and measurements. Their classical results 
which is unwanted to be leaked out should be completely secret. At the same time, Alice 
and Bob should entirely control their apparatus to generate the raw keys. Or else, the final 
key bits cannot be secure. 

As for commercial application, the apparatuses of Alice and Bob will be black boxes 
that may be provided by their potential rivals. It is interesting how Alice and Bob can 
determine the security of their final key bits extracted from these black boxes? Recently, 
the device- independent QKD (DIQKD) |13l-ll5l] has been suggested to ask for the answer. It 



was assumed in this protocol that Alice and Bob have no knowledge about their measure- 
ment devices. The violation of CHSH inequality will impose restriction on Hilbert space 
dimension of their measurements to ensure the efficient quantum correlations between Al- 
ice and Bo b [igI . IitI . Secure key bits against collective attack for this protocol has been 
proven |l5|. Its final key generation rate depends on two parameters, the quantity of 
CHSH polynomial 5* and the quantum bit error rate (QBER) Q. These two parameters 
are decided by the state measured by the legitimate users' devices and the way of their 
measurements at the same time. As Alice and Bob have no idea about the state prepared 
by Eve, and their measurement devices can also be fabricated by their rivals, generalization 
from collective attack to general attack is still missed. 

The way of state preparation in DIQKD is the same as those of EkertQl protocol 
and entanglement-based QKD protocol with sources in the middle 18|, ll9|] where Eve's 



eavesdropping ability is bounded with collective attack as quantum De Finetti theorem can 
be applied after Alice and Bob having randomized the measurement sequences on their 
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states 
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2l| . In DIQKD, however, It is impossible for Alice and Bob to make sure that 



their measurements function exactly on the quantum systems as their expectations. In fact, 
Eve may devise Alice's and Bob's measurements differently in every run. In this paper, a 
symmetric DI QKD p rotocol is proposed. The symmetry of this protocol, together with the 



Holevo limit 
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24j |. will provide strong confinements on Eve's eavesdropping. We show 



Eve's information is maximized when all states distributed to Alice and Bob are identically 
prepared. Then the procedure of uniform their states is completed automatically, and Alice 
and Bob can estimate their parameters by randomizing the sequences of their classical 
results. Furthermore, Eve's optimal state when her illegal information is maximized can be 
solely bounded with Alice and Bob's parameter S. Then our symmetric DIQKD has the 
same secure basis as that of Ekert91 protocol. 



II. A SYMMETRIC DIQKD PROTOCOL 

Our DIQKD protocol is symmetric not only because Alice's and Bob's basis choices are 
symmetric, but also because the statistical results generated from all bases are the same. It 
works as follows. (1) EPR pairs emit from the signal source set between Alice's and Bob's 
labs. One particle of the EPR pair is sent to Alice and the other one is sent to Bob. (2) Both 
Alice and Bob choose four expecting measurement bases as 9i = a^, O2 = {<Jx + a^l^2^ 
Os = a^i 64 = (— + az)/\/2 (As is shown in Fig. 1). In each run, Alice will randomly 
measure the incoming particle in one of the four bases, and so does Bob. (3) After all 
EPR pairs having been distributed, Alice and Bob announce the bases they used in each 
run through their classical channels. (4) Alice and Bob randomize the sequences of their 
classical results. They keep partial measurement results on the same bases as secrecy that 
will be used to generate secure final key bits. Then they publish all the other measurement 
results to estimate the disturbances and correlations on their sifted key bits. They abort 
their communication if the parameter estimation fails to meet their predefined requirements. 
Or else, they carry out privacy amplification to generate their secure final key. 

Without loss of generality, we assume Eve prepares all Alice's and Bob's systems and her 
auxiliary systems in a big state PAi...nBi...nE- Noting Alice's measurement operations as Ai, 
A2, A[ and A2, Bob's measurement operations as Bi, B2, B[ and B2, the joint measurements 
of Alice's and Bob's devices can then be depicted as (g)fi.^^(ti) ■ ■ ■ A'lVtN)(g)B-';! (tN). 
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FIG. 1: Schematic for symmetric DIQKD. AiS and A'-s are AHce's possible basis choices. BjS and 
-B^s are Bob's basis choices. 

Here ti, ■ ■ ■ , t^- are sorted in time sequence as Eve may eavesdrop on Alice's and Bob's 
measurements differently in every run, ui, un, vi, vn correspond to the upper 
indexes, and ii, ■ ■ ■ , in can be 1 or 2 randomly. As Eve's measurements will not affect 
the marginal distributions of Alice's and Bob's classical results, their results generated from 
pA^...i,B^...r,E can be depicted as Tr[A''i^{ti)®Bf^{ti) ■ ■ ■ {tN)®B'l^ {tN)TrE{pA^...t,B^...r,E)], 
where Tte is the trace on Eve's systems. According to DIQKD protocol, the result in the 
fcth run is Tr(A";(tfc) ® Bl^{tk){TrA^...^_^^+^...^B^...k-ik+i...NE{.pA^...MB^...ME)) = a^h^ , where 
and hk are the classical results obtained by Alice and Bob respectively. If they are binary, 
taking —1 and 1 for example, it is proven that A^Htk) and B^Htk) functioned on qubit 



states 



25l-l27l| . Furthermore, Ai^(tfc), A2^{tk)., Bi^{tk) and B2^{tk) can be set in the 
same plane x — z. Similarly, A[^{tk), A2^{tk), B[^{tk) and B2^{tk) can be set in another 

plane x' — z' HQ. 
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Defining TrA^...^_^^+^...^B^...k^^k+^...^E{,pA^...^B^...^E) = Pab, the Hilbert space of Al- 
ice and Bob as Ha r, p \p G Hab and dimHAB < 4 sfiould be satisfied. Accord- 



ing to Holevo limit 
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24j . Eve's ability to distinguish the state shared by Alice and 



Bob is limited by S{TrE{pAi...MBi...ME)), where S{p) = — Tr(p log2(p)) is the von Neu- 
mann entropy. If writing pA^...r,B^...„E as pA^...,,+,...r,B^...s,+^...„E, S{TrE{pA^...„B,...r,E)) < 
S{TrA,+^...j^B,+^...NEipA^...NB^...NE)) + S{TrA^...,Bi...sEipA^...NB^...NE)) is required for the sub- 
additivity of entropy. With the same procedure, one can have S{TrE{pAi...MB^...ME)) < 
ik+i..-NBi...k-ik+1-NEiPAi...pfBi...pfE))- The equality holds if and only if 
TrE{pA-^...NBi...NE) can be written as product systems shared between Alice and Bob, 
that is, TrE{pA^...MB^...ME) = ®k=iPAB- 

Eve controls the transmission of quantum state, thus she can make p\q optimal for her 
information gain. As dimHAB < 4, projective measurements can be launched on p\q in a 4- 
dimensional Hilbert space H, with Hab ^ H . Let = / be projective measurements 

in if, it is proven that Si^i p^^P^) ^ S{Pab)- The equahty holds if and only if p^^ = 
J2i P^PabP'' [24]. That is, P^PabP^ can be diagonalized in bases T = {rj with r^r/ = PK 
Defining A = P^p^^P^ = P^^p^^P, then A is a diagonal matrix in if, and P is composed 
with the basis vectors {t^}- Noticing Bell bases B = {q} is also a set of bases in H, there 
should be a unitary operator U satisfying T = UB. Then one can have A = B^^U'^p\^UB, 
which means p^^ can be diagonalized in Bell bases after it has been operated as p^^U ■ 
It is apparently that this process will not alter the amount of entanglement on p^^, and 
Eve's information gain is only determined by the elements of A. That is, the assumption that 
the state p\^ can be diagonlized on Bell bases will not affect Eve's information gain, and at 
the same time, it will not harm Eve's ability to intervene Alice and Bob's communication. 
Then it does not loss any generality to assume p\q can be diagonalized on Bell bases so 
long as both Alice's and Bob's marginal distributions are symmetric 1^, isl . 

Suppose the state distributed by Eve in the kth. run is cr^^ = (1 — Pk)p\<^+) + PfciP|<i>-) + 
Pfc2P|*+>+Pfc3P|vi.->, where pfc =pfc,+pfc2+Pfc3. 1"^^) = T^dOO) + |11)), 1$") = ^(|00) - |11)), 
|^+) = ^(|01) + |10)), and 1^") = ^TjdOl) - |10)). We now show that Eve's information 
on Alice and Bob's results is maximized when all cr^^s are identically prepared. 

(I) When there are only two types of quantum states equiprobably prepared on Alice and 
Bob's shared systems (This assumption does not loss any generality if these two states 
are prepared to be the same), they can be denoted as cr^ = (1 — p*-°-')p|$+) + Pi^Vl*-} + 
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P2°V|*+> + Pa^Vl*-} and a^^l = (1 - P^^^)p\<^+) + V|*-> + P\<i'+) + V|vi>->- Then 
Eve's information gain on these states should be represented as y5'((J^) + ^^'((j^^)- 
the statistical state on the entangled systems measured by Alice and Bob is aAB = 
(1 - p)p|$+) + Pip\^-) + P2P|*+) + PsPi^E--}, we have pf^ = pf^ = pi, pf' = ^ = p2, and 
Ps'^ = = ps when Eve's information gain is optimal. 

(II) When there are m types of density matrixes equiprobably prepared by Eve, we assume 
Eve's illegal information is maximal only when all of them are identically prepared on the 

entangled systems between Alice and Bob. That is, 5'(cr^) + S{a^^l) + ■ ■ • + S{(r^^) < 
fnS{aAB) is satisfied with the equality holds if and only if cr^ = cr^2 = ■ ■ ■ = (t'^ab ~ '^ab- 
Here aAB is the statistical expression on the A^ shared systems of Alice and Bob. 

(III) When there are m + 1 types of states measured by Alice and Bob equiprobably. 
Eve's information gain on them can be written as Se = ;;^['S'(cr^) + 5'(cr^2) + " " " + 
S{afjl) + Sia^^j^^'^)] . If the statistical expression for the first m types of states on the :;^^N 
systems is cr^^ = (1 — P*-^-*)p|$+) + Pi^V|*-> + p'f'^ P\^+) + pT^ P\^!~)-, Se can be bounded as 
;j^^[m5'((T^) + S{a^^^^)] according to step (II). With simple calculation, one can obtain 
its maximum value when = o"^^^'* = ctab, with aAB being the statistical representation 
of all A^ shared systems between Alice and Bob. In conclusion. Eve should prepare the state 
on the A^ systems identically if she want to maximize her illegal information from Alice and 
Bob's communication. Then there is no need to randomize the measurement sequences to 
make their states uniformly distributed. Quantum De Finetti theorem can b e appli ed in 
DIQKD protocol and Eve's information can be bounded with collective attack 201. l21|. 

Alice and Bob may not infer Eve's single intervention on their measurements in the kth 
run because of quantum randomness. As their states are identically prepared, however, they 
can deduce the equivalent operations averaged from all results. Denoting the equivalent 
operations in x — z plane as Ai, A2, Bi and i?2, their directions are assumed to be 6'i, 
6'2, ^pi and respectively. Similarly, denoting the equivalent operations in x' — z' plane 
as A'^^ A2, B[ and B2, the corresponding directions for them are 6'i, 62, <f'i and !f2. The 
CHSH polynomial can be calculated as S* = j ■5^(7^(3.5 — i — j)Tr{AiBjaAB), and 5" = 
sign{3.5 — i — j)Tr{A^BjaAB), with i, j = 1, or 2, and sign{x) getting the sign of x. 
Our symmetric DIQKD protocol requires 5* = S', moreover, it requires that all sign{3.5 — 
i — j)Tr{AiBjaAB)s and sign{3.5 — i — j)Tr{A\BjaAB)s have the same value j. Then one 
can obtain pi = p2, and 62 - 61 = f , ip2 - ^1 = -f , O2 - (fii = j and 61 - (p2 = f , or 
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02—91 = — f, ^2~Vi = f, 92 — ^1 = —J and6'i— = — f - With the same procedure, we can 
have the relationships among 6*2, and ^p^. It is interesting to find that measurements 
satisfying the above relationships can be proven to maximize the value of 5*. For Alice and 
Bob, bigger S means less disturbances, then Eve should have the measurements of Alice and 
Bob in every run obeys the above relationships in order to conceal her existence. 

Two important things may be reconsidered: what is the relationship between plane x — z 
and x' — z' and whether should Eve prepares the states for Ai, -Bi, B2 and A'^, A'^, 
B[, B'2 with different systems? It is interesting to notice that both questions deal with the 
relationship between measurements and information. And they can be answered at the same 
time. If plane x—z does not coincide with plane x' —z' , they belong to different Hilbert spaces. 
When Eve prepares the states on the same systems, generalized measurements are carried 
out inevitably when Eve distributes them in two different Hilbert spaces. This process will 
decrease Eve's information gain on the state 2J]. However, when Eve prepares the states on 
plane x — z and x' — z' with different systems, monogamy of entanglement means that Alice's 
and Bob's results extracted on the same bases should be totally uncorrelated 28l-l30l| . This 
will increase QBER on the key, that is, she will risk to be detected on line without gaining 
more information. Then for the sake of Eve's optimal information gain, and concealing her 
existence at the same time, the Hilbert space of x — z coincides with that of x' — z', and the 
states for them are prepared on the same systems correspondingly. 

When pi = P2, one can have the relationship pi + = | — If the measurement 
directions between Ahce and Bob are well aligned, the QBER can be calculated as pi + P3. 
Or else, it should be written as Q = i~(i-p-P3)cosi? ^ where is the included angle between 
these measurement directions. This value is greater than that of the former. Then Alice's 
measurement bases should keep alignment with those of Bob, one can obtain S = 2V2[1 - 
2Q], which is the same as that in IJ, ll5|. In practical implementation of DIQKD, Alice and 
Bob can not obtain the value of p. Defining q = p + p^, we have q = 1 — = 2Q. But the 
exact value of pi and p^ is still unknown. As Eve's information on cab can be written as 

2 

SicTAB) = -(1 - g + p-i) log2(l -q + p-i) - 2pi \0g2P1 - P3 loggPs, however, we have Ps = x 

2 

and Pi = 2~ ^ when S{pab) is maximal. That is, the optimal state for Eve's eavesdropping 
is aj^*""'' = (1 - g + ^)p|$+) + (f - t)/'!*"} + (2 ~ ^)P|*+> + ^P|*->- Different to the cases 
where Alice and Bob having full control of their measurement devices 31rl33| , color noise is 



optimal for Eve in the DIQKD protocol. This is because Alice and Bob can calculate the 
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value of p accurately in the former but they can only estimate the value of q in the latter. 

Until to now, we have proven Eve's optimal information to be S{a°l^^°'^). If its corre- 
sponding quantity of CHSH polynomial is 5'°^**'""', however, can Eve's optimal information 
be bounded as 5(0"^^™"') when Alice and Bob's statistical value of S is equal to 5'°^**™''^'? 
If not so, there must be another ^^J^*™*^'' ^ith which Eve can obtain more illegal informa- 
tion. That is, S{a'^^"^"'''') > S{a°^^^°'^) is satisfied. According to the discussion above, 
^c^ttmaii gj^Q^j^ ^Yso be represented as cr°P^*™'^'' = (i _ g' _(_ ^)p|^+^ -|_ (|. _ ^)p|^„^ _)_ (|. _ 

^)p\^+) + ^P\^-)- Its corresponding S can be calculated to be less than 2a/2(1 — q'). As 
5((tJ"') > one can have < 2^2(1 - q') < 2v^(l - q). For Alice and 

Bob, great S means less information can be obtained Eve, which means 5"°^**™"' can bound 
Eve's illegal information. Generally, if the value of CHSH polynomial is S*, Eve's illegal 
information should be less than E{S) = + ^) loga + ifl) " " iff) ^^^2 i(l " 
ifs) ~ f^) log2(i ~ §)• T^^^^i DIQKD can be bounded with the quantity of CHSH 
polynomial, which means it has the same secure basis as that of Ekert91 protocol [2]. For 
collective attack, Alice and Bob's key generation can be represented as r = 1 — H2{Q) — x, 
where H2(Q) = —Q log2 Q — {1 — Q) log2(l — Q) is the Shannon entropy and x is the Holevo 



limit 
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35| . In our symmetric DIQKD, the lower bound of Alice and Bob's key generation 
rate can be estimated as r > 1 — H2{Q) — ^(cr^B*™"')- If the relationship S = 2^/2{l — 2Q) 
is satisfied, the key rate of our DIQKD can be calculated as 

III. DISCUSSION AND CONCLUSION 

In this paper, a symmetric DIQKD has been proposed, where Eve's ability of eaves- 
dropping can be bounded with collective attack. That is, generalization on the security of 
DIQKD from collective attack to general attack can be realized. Its security can be esti- 
mated similarly as that of Ekert91 protocol, that is, determined by the quantity of CHSH 
polynomial S. However, we have only considered an ideal case where the loss in the quantum 
channel is not added in. In practical implementation of this protocol, there may be detect- 



ing loophole because of imperfectly detecting efficiency [32|, l33[. Especially, faking state 



attack has been proposed to eavesdrop on DIQKD protocols with inefficient measurement 



devices 



361]. To make DIQKD more practically with present devices, however, proposition 
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for experimental realization of this protocol has been given j37|. Besides its attractiveness 
of practical application, DIQKD is physically interesting as it provides us a way to under- 
stand the nonlocality of quantum principles, with which the legitimate users can set up 
secure communication without any knowledge about their quantum objects. The author 
thank helpful discussion from Q.-Y. Cai and X. Ma. This work is sponsored by the National 
Natural Science Foundation of China (Grant No 10905028) and HASTIT. 
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Appendix A: Bounding Eve's information with Holevo limit 

In DIQKD, Alice and Bob measure on the state p prepared by Eve. According to the 
Holevo limit, Eve's illegal information on the results of Alice and Bob can be bounded with 
S{p). If p is composed with many subsystems, that is, p = pi,2,---,n- S{p) can be proven to 
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satisfy the relationship 

n 

S(p)<J2s{Pi), (Al) 

i=l 

where pi is the state functions with Ahce and Bob's measurements in the ith run. This 
conclusion can easily be proven with Klein's inequality S{p) < — Tr(plog2 cr). Defining 
p = pi,2,- -,n, c" = ®iLiPi, and substituting them into the Klein's inequality, we have 

S{pi,2,-,n) < -rr(pi,2,...,„log2(8)r=iPi) 

= -Tr(pi,2,..,n(iog2nr=iP0) ^^2) 

= -Tr(pi,2,...,„(Er=ilog2 Pi)) 
= EUSip^. 

The equality holds if and only if the state can be written as product states of n systems. 



Appendix B: Diagonalizing pab on Bell bases 

Suppose Pi is a complete set of orthogonal projectors and p is a density operator. Then 
the entropy of the state a = PipPi of the system after the measurement is at least as 
greater as the original entropy 

S{a) > S{p)). (Bl) 
This results can be verified easily with Klein's inequality. 

S(p) < -Tr(p\og^a) 

= -Tri^^P^P,plog,a) ^^^^ 
= -Tr{j:^P,plog,aP,) 
= -TriZiPipPdog^cj) 

If PiS arc the set of projective operators which can maximize Eve's information after it has 
functioned on state p. Writing Pj as Tjr/, then T = {tj} is the basis of the Hilbert space of 
p, and p is diagonal in basis T — {tj}. Then a is the diagonalized density matrix of p on 
basis T — {tj}. 

Now we will show p can be diagonalized in any other set of bases of the Hilbert space 
of p. If QiS are another set of projective operators in this Hilbert space, and Qi — q^^, 
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V — {^i}s are also orthogonal bases of the Hilbert space of p. Similarly, we can define 
matrix Q constituting of bases V — {^j}, then there exists a unitary matrix U, with which the 
relationship P — UQ can be satisfied. We can rewrite density matrix u as cr = Q~^U~^pUQ. 
That is, p can be diagonalizcd on basis V = {<^j} after Eve operating it as U'^pU . That 
is, if a quantum state can be diagonalized on one basis in the Hilbert space of p, it can be 
diagonalizcd on any other bases in this Hilbert space by just rotating the states with some 
unitary operation. 

In DIQKD, Alice's and Bob's classical results are binary, it is proven that their measure- 
ments can extract qubit information from the states on the incoming particles. Then the 
state measured by Alice's and Bob's devices are confined in the Hilbert space H^b^ with 
(\\mHAB < 4. That is. Bell basis is a set of basis in this Hilbert space. Then if Eve can 
diagonalize state p with projective operators in the Hilbert space of Hab-i she can diagonalize 
it on Bell basis. 



Appendix C: Alice and Bob's states should be identically prepared if Eve want her 
illegal information maximized 

This conclusion can be proven with simple mathematical technique. Suppose there are 
m types states prepared for Alice and Bob. 

(1) When m = 1, all states are identical. 

(2) When m — 2, they are denoted as = (1— P^°'^)P|*+>+Pi'^V|*->+P2"V|*+>+P3°V|*-> 
and = {i—p^^'')p\^+)+p^f''p\^-)+p^^P\-^+)+p^^P\-ii-)- And their statistical representation 
of all systems can be written as pab = (1 ~p)P|$+> +PiP|$-> +P2P|*+) +P3/0|*-)- These two 
types of states are assumed to be prepared equiprobably, and this assumption does not loss 
any generality if these two types of states can be proven to be the same. 

Then Eve's information gain on these states should be less than y['S'(p^^) + S{p^q)], 
with N is the number of the total systems shared between Ahce and Bob. One can then 
have 

pS"^+pf)=2pi, 

pr^+pf =2p„ (ci) 
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and 



[S{p1b) + S{p^ab)] 



la) 1 (a) (a) i (a) (a) i (a) 

-(1 - P^^ - P?^ - P?^) log2((l - Pi"^ - P?^ - P?^)) (C2) 

-Pf^ log2 pf ^ - pf ^ log2 pf ^ - pf ^ log2 pf ^ 

-(1 - Pf - Pf - Pf ) l0g2((l - pV - Pf - Pf )) 

Substituting the relation in Eq. (7) into Eq. (8), we have Se = Se{Pi^\p2^\p^^^)- Varying 
Pi"\ P2^\ Ps"^ to make Se maximal, we can then have p^"^ — p^P — pi, P2"^ = P2'^^ = P2, 
and pf^ = pf^ = p3. 

(3) Suppose all types of states are identically prepared on the N systems for Eve's maximal 
information gain when m = M > 3. That is, Eve should make her eavesdropping optimal 
if M types of states are prepared on the systems shared between Alice and Bob, — 

— ■ ■ ■ — p^-* = are required, with pAB is the statistical state on the N systems. 
That is, Se = f [-^IpS) + S{pfl) + • • • + S{p^^b)\ = NS{pab) calculates the optimal 
information obtain by Eve. 

(4) When m = M + 1, we still assume all states are prepared equiprobably. Then Se — 
a^+tI'^IPab) + ^iPAs) + ■ ■ ■ + S{paj^) + S{p^'^^^^)]. Suppose the statistical representation 
for the first M types of density matrix is p^^, 

Se = i^MP^AB) + S(pVB)) + --- + S(pZ^) + S(p(^^n 

- [^(pS) + Sip^B)) + ■■■ + S{P%^)] + j^^S{p(^^')) (C3) 

< §^,S{p%) + j^^S{pi^^^^ 

Denoting p% = (1 - p(^))p|^+^ + + + and pi^+^Us ^ (i _ 

p{M+i)-^p^^^^ +P2^^^V|*+> +P3^^^V|*->) with similar procedure as that in step 

(2), we have pf'^ — p^'^"'"^^ = pi, P2^^ = pi^'^^^ — P2, and pg^^ = pi'^'^^^ — Pa- That is, the 
M + 1 types of states are also required to be identical for Eve's optimal eavesdropping. Then 
all states on the N systems shared between Alice and Bob should be identically prepared if 
Eve want to maximize her illegal information. 



Appendix D: Bounding Eve's eavesdropping on Alice's and Bob's measurements 

Denoting the equivalent operations in x— 2; plane as Ai, A2, Bi and B2, their directions are 
assumed to be 9i, 62, (fii and </?2 respectively. Similarly, denoting the equivalent operations 
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in x' — z' plane as A'^, A2, B[ and B2, the corresponding directions for them are 9'i, $2, (p'l 
and </?2. The state Eve prepares on Ahce and Bob's shared systems is pab — (1 —p)p\^+) + 

PiPl*-) + P2P\^+) + P3P\^-)- Then S = {I - p -p3)[cos(^i - (fi) + cos(^i - ip2) + cos(^2 - 

V^l) - C0S(^2 - ^2)] - (Pl - P2)[C0S(^1 + ifi) + COs(^i + (P2) + C0S(^2 + ^l) - COs(^2 + ^2)] 

can be obtained. Furthermore, the correlation results on neighbour bases can be depicted 
as SaiBi = (1 - P - P3) cos(6'i - (pi) - {pi - pa) cos(6'i + (pi), Sa^b^ = (1 - P - Pa) cos(6'i - 
V2) - (Pi - P2) cos(6li + (/72), Sa^b^ = (1 - P - Ps) cos(6l2 - </?i) - (pi - P2) cos(6l2 + </7i), and 
-SA2B2 = (1 - P - Ps) cos(^2 - ^2) - (Pi - P2) cos(^2 + ^2) respectively. The symmetry of 
our DIQKD requires Sa^b^ — Sa^B2 = SA2B1 = —SA2B2 = f > then we have 

(1 - p - P3) cos(6'i - (fii) - {pi - P2) cos(6'i + 
= (1 - P - Ps) cos(6li - (/?2) - (pi - P2) cos(6li + </?2), 
= (1 - p - P3) cos(6'2 - (pi) - (pi - P2) cos(6'2 + v^i), 
= -(1 - p - Ps) cos(6'2 - ^2) + (Pi - P2) cos(6'2 + (P2)- 

Based on these relationships, we can obtain 

(1 - p - Ps) sin( ^ei-^i-'P^ ) sin(^^) = -(pi -p2)sin(2^i+f±^ei)sin(^2i^), 

i'-^) = -(pi-p2)sin(Mi±^)sin(^), ^^^^ 



(Dl) 



261- 




-V2 ■ 




2 




2ipi- 


-01- 


-02 -j 




2 




■202- 




-f2 




2 




■2^2- 


-01- 


-62^ 



2 y \fi I'i) ^""V 2 / 2 



(l-p-p3)cos(^^e2z|ii:^)cos(^) = (pi-p2)cos(?^2i|i±^)cos(^). 

As S should violate its classical bound 2, it is reasonable to assume that the value 
P1+P2+P3 is small. Then (1— p— Ps) is comparable with 1. If cos(^i^^) = 0, cos( ^^~^^ ) = 0, 
sin C^^'*^^ ) = 0, or sin( ^^~^^ ) = 0, one can obtain S < 2, which is not expected in DIQKD. 
Then Eq. (D2) can be simphfied as 



(l-p-p3)sin(^^i^M) = -(p,-p2)sin(toi±^), 
(1-P-P3)sin(^^^i^) = -(p,-p2)sin(?^i+|i±^), 
(l-p-p3)cos(^fai^) = (pi-p2)cos(^^2±f±^), 

(1-P-P3)c0s(2£^^|i^) = (P1-P2)C0S( ^%^^+^^ ). 

If both sides of Eq. (D3) are not equal to 0, one can obtain 



(D3) 



sin(6'i + 62) + sm{9i - 62) cos(v5i + (P2) = 0, 
sin((/?i + (/?2) + sin((/7i - (/?2) cos(^i + 82) = 0. 



(D4) 
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We can find the maximal value conditioned on the relationships in (D4), we find S < 2 
in this condition. By further calculation, we can find that sin( ^^^"^'^^"'"'^^ ), sin( ^'^^"'"|^"'"^^ ), 
cos(2toi±£2)^ and cos(2^^^i^) can not be equal to at the assumption of ,5 > 2. Then 

we have pi = p2 should be satisfied. And at the same time, we have 62— Oi = ^, ^2—^1 = ~f ) 
02-<P\ = \ and 6*1 - (^2 = f, or 62 -9i^ -|, ip2-ipi = |, 92-ipi = -f and 6'i-(^2 = -f ■ 
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